EU-hosted · TLS · RBAC

Sovereign Security

EU-hosted. TLS on the gateway. Roles and keys on every API.

Production sits on operator-controlled infrastructure (Hetzner EU). Only nginx is public. APIs require a frontend key; website sessions are JWTs; passwords are bcrypt; agent runs are written to an audit table. That is the live control set — not a hardware HSM or a service mesh.

◈TLS on the production gateway

◈Docker network isolation

◈JWT + frontend API key

◈Role-based access (guest to admin)

◈bcrypt password hashing

◈agent_runs audit log

Defense in Depth

Host isolation (Docker, no-new-privileges)L1

Private Docker network (only nginx is public)L2

TLS on the production gateway (nginx + certbot)L3

Shared frontend key on /api/frontend and /api/agentsL4

JWT sessions + role gates (guest → admin)L5

bcrypt passwords · agent_runs audit trailL6